T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:119
- Finding
- Shell Command Injection Through Unsanitized Video Titles and URLs<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 119–124. Related unsafe interpolation patterns also appear at lines 65, 77–83, 89–95, and 104–111. **Vulnerability Type**: Shell command injection caused by direct interpolation of untrusted values **Risk Level**: High ### Vulnerable Code ```bash ffmpeg -y \ -i "<视频标题>/<视频标题>.source.mp4" \ -vf "subtitles='<视频标题>/<视频标题>.srt'" \ -c:v libx264 -crf 20 -preset medium \ -c:a copy \ "<视频标题>/<视频标题>.mp4" ``` Related URL interpolation: ```bash yt-dlp --dump-single-json "<YOUTUBE_URL>" ``` Related title-derived output paths: ```bash yt-dlp \ -f "bestvideo[height<=1080][ext=mp4]+bestaudio[ext=m4a]/best[height<=1080][ext=mp4]/best[height<=1080]" \ --merge-output-format mp4 \ -o "%(title)s/%(title)s.source.%(ext)s" \ "<YOUTUBE_URL>" ``` ```bash yt-dlp \ --skip-download \ --write-thumbnail \ --convert-thumbnails jpg \ -o "%(title)s/%(title)s.%(ext)s" \ "<YOUTUBE_URL>" ``` ```bash yt-dlp \ --skip-download \ --write-sub \ --write-auto-sub \ --sub-langs "zh-Hans,zh-CN,zh,zh-TW,*" \ --sub-format "srt/best" \ -o "%(title)s/%(title)s.%(ext)s" \ "<YOUTUBE_URL>" ``` ### Technical Analysis The skill directs the agent to insert a user-provided YouTube URL and a remotely supplied video title directly into shell command templates. The video title is subsequently used in FFmpeg input paths, output paths, and a `subtitles` filter expression. If the agent constructs a command as text and replaces the placeholders before passing it to a shell, shell metacharacters embedded in a URL or video title may become executable syntax. Double quotes prevent ordinary word splitting but do not neutralize shell constructs already present in the generated command, including command substitution expressions such as `$(...)` and backticks. The FFmpeg filter argument additionally has its own escaping rules, creating further opportunities for filter-expression injection or command failur ...[truncated 1950 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Avoid shell command construction** - Invoke `yt-dlp` and FFmpeg through a process API that accepts an argument array. - Disable shell execution explicitly, such as `shell=False`. - Pass the URL and every path as individual opaque arguments. 2. **Validate URLs structurally** - Parse URLs with a trusted URL parser. - Allow only HTTPS URLs whose normalized host is exactly an approved YouTube domain, such as `youtube.com`, `www.youtube.com`, `m.youtube.com`, or `youtu.be`. - Reject embedded credentials, control characters, malformed encodings, and unexpected schemes. 3. **Do not reconstruct paths from raw titles** - Generate a sanitized local directory name independently from display metadata. - Remove control characters and platform-specific path separators. - Reject `.` and `..` path components. - Apply a conservative character allowlist and a fixed maximum length. - Consider using the YouTube video ID or a generated identifier as the filesystem directory name while retaining the original title only as metadata. 4. **Contain filesystem output** - Resolve each generated path against a designated output root. - Verify that the normalized path remains inside that root before creating or writing files. - Refuse symlinks or pre-existing paths that resolve outside the output directory. 5. **Handle FFmpeg filters safely** - Do not build the `subtitles` filter from an unescaped title. - Use a generated safe subtitle filename in a controlled working directory. - Apply FFmpeg filter-specific escaping through a tested library or helper. - Prefer passing a simple relative filename after setting FFmpeg's working directory to the validated video directory. 6. **Document the safe execution requirement** - State explicitly that placeholders are conceptual and must never be replaced in a shell command string. - Include secure argument-array examples rather than copyable shell te ...[truncated 48 chars]